JP5229408B2 - Information processing apparatus and user authentication program - Google Patents

Description

  The present invention relates to an information processing apparatus and a user authentication program.

  Conventionally, as a technique for authenticating a user in an information processing apparatus, in Patent Document 1, a user ID and password of a user permitted to be used by an administrator are registered in the information processing apparatus and stored in advance as user management information. A technique for authenticating a user by collating a user ID or password input at the time of login with user management information is described.

  However, when a user uses a plurality of information processing apparatuses, the administrator must manage user management information of each information processing apparatus individually, which is complicated.

  Therefore, Patent Document 2 discloses a technique for connecting an information processing apparatus and an authentication apparatus storing user management information via a network, and transmitting a user ID and password input at the time of login to the authentication apparatus to authenticate the user. Is described.

  Further, in Patent Document 3, in a configuration in which an information processing device and an authentication device are connected via a network, an administrator registers a user ID and a password of a user permitted to use the information processing device and the authentication device, respectively. A technique is described in which user authentication is performed by storing the management information in advance and collating with the user management information stored in the information processing apparatus when the network is disconnected.

JP 2004-98505 A JP 2005-38435 A JP 2005-56393 A

  An object of the present invention is to provide an information processing apparatus and a user authentication program capable of performing user authentication even when a network is disconnected while suppressing the trouble of registering a user permitted to be used by an administrator. To do.

An information processing apparatus according to claim 1 identifies a user and a communication means for communicating with an authentication apparatus that authenticates whether or not the user is permitted to use via a connected communication cable. A receiving unit that receives input of identification information to perform authentication, and when the input of the identification information is received by the receiving unit, requests for user authentication by transmitting the identification information to the authentication device by the communication unit and, wherein when the can authenticate the authentication device, as information to be used when communicating with the authentication device is in the disconnected, a storage means for storing identification information accepted by said accepting means, before Symbol authentication device Authentication means for authenticating a user using the identification information stored in the storage means and the identification information received by the receiving means when communication with the storage means is interrupted. Receives an input of authentication designation information for designating whether or not to allow the authentication of the user based on the identification information stored in the storage means, the authentication means, the user authentication is permitted in the authentication designation information When the communication with the authentication device is interrupted, the user is authenticated by the identification information stored in the storage means and the identification information received by the reception means.

According to a second aspect of the present invention, in the first aspect of the invention, when the input of the identification information is received by the reception unit, the identification information is transmitted to the authentication device by the communication unit. Control means for requesting the user to authenticate and when the authentication apparatus cannot authenticate, the control means controls so that the identification information received by the receiving means is not stored in the storage means .

Further, the invention according to claim 3 is the invention according to claim 1 or claim 2, wherein when communication with the authentication device is interrupted, the specifying means for specifying the cause of disconnection and the specifying When the cause of the disconnection specified by the means is a disconnection of the communication cable at the communication means, the authentication means prohibits user authentication with the identification information stored in the storage means, and is specified An authentication control means for permitting user authentication with the identification information stored in the storage means by the authentication means when the cause of the disconnection is not the disconnection of the communication cable at the communication means ; It is.

The invention according to claim 4 is the invention according to any one of claims 1 to 3, wherein the authentication means is permitted when user authentication is permitted in the authentication designation information stored in the storage means. The monitoring time for monitoring the communication state with the authentication device is shortened in order to determine whether or not the authentication result information has been obtained from the authentication device, compared with the case where the authentication device is not used.

According to a fifth aspect of the present invention, in the first to fourth aspects of the invention, the authentication device identifies the user together with authentication result information in response to a user authentication request from the authentication means. Return identification registration permission information indicating whether or not to permit storage of the information in the storage means,
The storage means stores the identification information in the storage means and stores the identification information in the storage means when storage is permitted by the identification registration permission information when the information indicating that the authentication is successful is received from the authentication device. When the storage is not permitted by the permission information, the identification information is not stored in the storage means.

  According to a sixth aspect of the present invention, in the first to fifth aspects of the present invention, the accepting unit accepts input of password information indicating a password of the user together with identification information for identifying the user. When the storage means receives information indicating that the authentication has been successful from the authentication device, the identification information and the password information are stored in association with each other, and the authentication means has lost communication with the authentication device. If it is, the user is authenticated by the identification information and password information stored in the storage means and the identification information and password information received by the reception means.

  The invention according to claim 7 is the invention according to claim 6, wherein the storage means further stores password registration permission information indicating whether or not to permit registration of the password information, and the storage means When the information indicating that authentication has been received is received from the authentication device and registration is permitted in the password registration permission information, the identification information and the password information are stored in the storage unit, and information indicating that the authentication has been completed When receiving from the authentication device and registration is not permitted in the password registration permission information, only the identification information is stored, and the authentication means is not permitted to register in the password registration permission information, And when the communication with the authentication device is interrupted, the identification information stored in the storage means and the reception means Perform authentication of the user in a separate information.

On the other hand, a user authentication program according to an eighth aspect of the present invention is directed to a user authentication program via a connected communication cable when an input of the identification information is received by a receiving unit that receives an input of identification information for identifying a user. is a transmission step of transmitting to the authentication device for authenticating whether the user permits for by Ri uses to communicate means, if successfully authenticated by the authentication device, communication with the authentication device and disconnected The storage step of storing the identification information received by the reception unit in the storage unit as information to be used in the case of being, and specifying whether or not to allow user authentication based on the identification information stored in the storage unit when receiving input of authentication designation information, and user authentication is permitted in the authentication designation information, and communication with the authentication device is in the disconnected, the An authentication step of identification information received and identification information and the receiving unit stored in 憶 means performs authentication of a user, it is intended to execute on a computer.

Further, the invention according to claim 9 is a control step for controlling so that the identification information received by the receiving means is not stored in the storage means when the authentication apparatus cannot authenticate in the invention according to claim 8. And further.
Further, the invention according to claim 10 is the invention according to claim 8 or claim 9, wherein when the communication with the authentication device is disconnected, the specifying step for specifying the cause of the disconnection, and the specifying When the cause of the disconnection specified by the step is a disconnection of the communication cable at the communication means, the authentication of the user with the identification information stored in the storage means at the authentication step is prohibited and specified An authentication control step for permitting user authentication with the identification information stored in the storage means by the authentication step when the cause of the disconnection is not a disconnection of the communication cable at the communication means; Yes.

According to the invention described in claim 1, claim 2, claim 8 and claim 9 , when authentication that the user is permitted to use is obtained, the identification information obtained by the authentication is registered. When the result information indicating the authentication result by the authentication device is not obtained, the user is authenticated based on whether or not the identification information is previously registered identification information. This has the excellent effect that the user can be authenticated even when the network is disconnected while suppressing the trouble of registering the user who permits the user.

Further, according to the invention described in claim 3 and claim 10 , when the communication cable is disconnected, the authentication of the user based on whether or not the identification information is stored is prohibited, thereby reducing the security. It has an excellent effect that it can be suppressed.

  Further, according to the invention described in claim 4, when the result information indicating the authentication result cannot be obtained, it is possible to quickly switch to the user authentication based on the identification information stored in the storage unit. Have

  In addition, according to the invention described in claim 5, since it is possible to select whether or not registration of identification information is permitted, it is possible to suppress a decrease in security by making a selection not permitting registration as necessary. It has the excellent effect of being able to.

  Further, according to the invention described in claim 6, there is an excellent effect that security can be enhanced by performing authentication using the user identification information and password information.

  Furthermore, according to the invention described in claim 7, since it is possible to select whether or not to permit registration of password information, it is possible to suppress a decrease in security by making a selection that does not permit registration as necessary. It has the excellent effect of being able to.

1 is a block diagram showing an overall schematic configuration of a document authentication system according to an embodiment. It is a block diagram which shows the structure of the multifunctional device and server which concern on embodiment. It is a flowchart which shows the flow of a process of the user authentication program which concerns on 1st Embodiment. It is a flowchart which shows the flow of a process of the user authentication program which concerns on 2nd Embodiment. It is a flowchart which shows the flow of a process of the user authentication program which concerns on 3rd Embodiment.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In the following, the present invention will be described with respect to a user authentication system in which a multifunction device serving as an information processing device and an authentication device are connected to authenticate a user who uses the multifunction device in the authentication device.
[First Embodiment]
FIG. 1 shows an overall schematic configuration of a user authentication system 10 according to the present embodiment.

  As shown in FIG. 1, the user authentication system 10 includes a plurality of multifunction devices 12 and an authentication device 14, and the multifunction device 12 and the authentication device 14 are connected by a network 16.

  FIG. 2 shows the configuration of the multifunction machine 12 and the authentication device 14 according to the present embodiment.

  As shown in the figure, the multifunction machine 12 reads an image from a recording sheet placed at a predetermined reading position, and obtains image data indicating the image, and onto the recording sheet by electrophotography. A print engine unit 24 for printing an image, an operation panel 26 provided with a display unit for displaying operation buttons, numeric keys, various messages and the like for inputting various operation instructions such as a copy operation, and an IC. (Integrated Circuit) IC card reader 28 for reading information stored in the card.

  Note that the print engine unit 24 according to the present embodiment can form a full-color image using toners of four colors of yellow, magenta, cyan, and black. Further, it is possible to form a black and white grayscale image using only black toner.

  The multifunction machine 12 also temporarily stores a CPU (Central Processing Unit) 30 that controls the operation of the entire apparatus, a ROM 32 that stores various programs including a control program and a user authentication program described later, and various data. RAM 34, an HDD (hard disk drive) 36 that stores and holds various data, a scanner driver 38 that controls reading of an optical image by the scanner 22, and printing that controls the operation of the print engine unit 24. An engine control unit 40, a panel control unit 42 that detects an operation state of the operation panel 26, a card reader control unit 44 that controls reading of an IC card by the IC card reader 28, and a network 16 connected to the network 16. Network interface (interface) for sending and receiving communication data between And parts 46, and a.

  The CPU 30, ROM 32, RAM 34, HDD 36, scanner driver 38, print engine control unit 40, panel control unit 42, card reader control unit 44, and network I / F unit 46 are connected to each other via the system bus BUS1. . Therefore, the CPU 30 can access the ROM 32, RAM 34, and HDD 36, controls the operation of the scanner 22 via the scanner driver 38, controls the operation of the print engine unit 24 via the print engine control unit 40, Control of reading of the IC card by the IC card reader 28 via the card reader control unit 44 and control of data transmission / reception with other terminal devices connected to the network 16 via the network I / F unit 46, respectively. It can be carried out. Further, the CPU 30 can grasp the operation state of the user with respect to the operation buttons and numeric keys provided on the operation panel 26 via the panel control unit 42. Further, the CPU 30 can control the display of messages on the display unit provided on the operation panel 26 via the panel control unit 42.

  On the other hand, the authentication device 14 is configured as a server computer, and includes a display 70 for displaying an operation menu, a message, and the like, and a keyboard 72 for inputting various operation instructions from the user.

  The authentication device 14 according to the present embodiment includes a CPU 80 that controls the operation of the entire device, a ROM 82 that stores various programs including a control program in advance, a RAM 84 that temporarily stores various data, and various data. Are connected to the network 16, are connected to the network 16, are connected to the network 16, are connected to the network 16. A network I / F unit 92 that transmits and receives communication data between them.

  The CPU 80, ROM 82, RAM 84, HDD 86, display driver 88, operation input detection unit 90, and network I / F unit 92 are connected to each other via the system bus BUS2. Therefore, the CPU 80 can access the ROM 82, RAM 84, and HDD 86, controls display of various information on the display 70 via the display driver 88, and accesses the network 16 via the network I / F unit 92. It is possible to control data transmission / reception with other connected terminal devices. Further, the CPU 80 can grasp the operation state of the user with respect to the keyboard 72 via the operation input detection unit 90.

  Next, user authentication by the user authentication system 10 according to the present embodiment will be briefly described.

  In the authentication apparatus 14 according to the present embodiment, a user ID is registered in advance as identification information for identifying a user who is permitted to use each MFP 12 by an administrator, and the registered user ID Is stored in the HDD 86.

  On the other hand, the multifunction machine 12 according to the present embodiment performs user authentication using the user ID, and when it is confirmed that the user is a valid user by performing user authentication, a scanning operation of the document by the scanner 22 is performed. Various operations such as copying and copying are possible.

  Further, the multifunction machine 12 stores in the HDD 36 ID information of a user who has been previously authenticated by the authentication device 14.

  When using the multifunction machine 12, the user inputs a user ID by causing the IC card reader 28 to read a numeric keypad provided on the operation panel 26 or an IC card storing ID information.

  When the MFP 12 receives an input of a user ID by reading the IC card with the numeric keypad provided on the operation panel 26 or the IC card reader 28, the MFP 12 sends the ID information indicating the user ID to the network I / F unit. 46, the request is sent to the authentication device 14 to request user authentication.

  The authentication device 14 authenticates the user by checking whether or not the ID information transmitted from the multifunction device 12 is stored in the HDD 86, and transmits result information indicating the authentication result to the multifunction device 12.

  When the result information is obtained from the authentication device 14, the multifunction machine 12 authenticates the user according to the result information.

  Then, when the authentication that the user is permitted to use is obtained from the result information, the multifunction machine 12 registers the ID information of the user who has obtained the authentication in the HDD 36.

  Also, the multifunction machine 12 indicates the accepted user ID when, for example, a communication failure occurs in the network 16 and communication with the authentication apparatus 14 cannot be performed and result information cannot be obtained from the authentication apparatus 14. The user is authenticated by checking whether the ID information is stored in the HDD 36 or not.

  Then, the multifunction machine 12 permits the use of the multifunction machine 12 when authentication is obtained by authentication by the authentication device 14 or by checking whether or not the data is stored in the HDD 36.

  Next, a detailed processing flow of the multifunction machine 12 when performing user authentication will be described.

  FIG. 3 is a flowchart showing a flow of processing of a user authentication program executed by the CPU 30 when an input of a user ID is accepted by the operation panel 26. The program is stored in advance in a predetermined area of the ROM 32.

  In step 100 in the figure, ID information indicating the user ID accepted by the operation panel 26 is transmitted from the network I / F unit 46 to the authentication device 14 via the network 16 to request user authentication.

  In the next step 102, it is determined whether or not the result information is received from the authentication device 14. If the result information is received, the process proceeds to step 106. If the result information is not received, the process proceeds to step 104.

  In step 104, it is determined whether or not a predetermined monitoring time (for example, 30 seconds) has elapsed since the ID information was transmitted in step 100. If the determination is affirmative, the process proceeds to step 114, while the negative determination is made. When it becomes, it moves to step 102 and continues waiting for reception of the result information.

  In step 106, it is determined whether or not the user is authorized to use in the received result information. If the determination is affirmative, the process proceeds to step 108, whereas the determination is negative. Goes to step 120.

  In step 108, login to the apparatus is permitted, the operation panel 26 is validated, and various operations on the operation panel 26 are accepted.

  As a result, use of the multifunction device 12 is permitted to a user who has been authenticated by the authentication device 14 as being a user whose use is permitted.

  In the next step 110, the ID information of the user who has been authenticated in step 106 is registered and stored in the HDD.

  As a result, the HDD 36 of the multifunction machine 12 stores ID information of a user who has been authenticated by the authentication device 14 as being a user permitted to use.

  On the other hand, in step 114, whether or not the user is permitted to use is verified by checking whether or not the user ID information received by the operation panel 26 is stored in the HDD 36.

  In the next step 116, it is determined whether or not the ID information can be collated. If the collation can be performed, the process proceeds to step 118. If the collation cannot be performed, the process proceeds to step 120.

  In step 118, login to the apparatus is permitted, the operation panel 26 is validated, and various operations on the operation panel 26 are accepted.

  Thereby, for example, even if a communication failure occurs in the network 16 and communication with the authentication device 14 cannot be performed, and result information cannot be obtained from the authentication device 14, user authentication can be performed. The use of the multifunction device 12 is permitted to a user who has been authenticated as a user who is permitted to use the device.

  On the other hand, in step 120, login to the apparatus is not permitted, the operation panel 26 is invalidated, and various operations on the operation panel 26 are not accepted.

  As a result, the multifunction device 12 cannot be used for a user who cannot be authenticated as a user permitted to use.

  In step 122, the authentication result is displayed on the display unit provided on the operation panel 26, and the user authentication program is terminated.

As described above, according to the present embodiment, when authentication that the user is permitted to use is obtained by the authentication device 14, the management is performed by registering the ID information of the user who has obtained the authentication. The burden of registering a user who is permitted to use by a user is reduced. Further, when the result information by the authentication device 14 cannot be obtained, the user authentication is performed based on whether or not the ID information is previously registered ID information. Therefore, even when the network is disconnected, the user authentication is performed. Yes.
[Second Embodiment]
The configuration of the user authentication system 10 according to the second embodiment and the configurations of the multifunction machine 12 and the authentication device 14 are the same as those in the first embodiment (see FIGS. 1 and 2). Description of is omitted.

  Next, user authentication by the user authentication system 10 according to the present embodiment will be briefly described.

  In the authentication apparatus 14 according to the present embodiment, a user ID and password of a user who is permitted to use each MFP 12 are registered in advance by an administrator, and ID information indicating the registered user ID and Password information indicating a password is associated and stored in the HDD 86.

  The authentication device 14 is registered for each user by the administrator as to whether or not the registration of the user ID information and password information to the HDD 36 of the MFP 12 is permitted. Identification registration permission information indicating whether or not to do so is stored in the HDD 86 in association with the user ID information.

  The authentication device 14 returns identification registration permission information associated with the user ID information together with the result information in response to the user authentication request.

  On the other hand, the multifunction machine 12 according to the present embodiment performs user authentication using a user ID and a password, and when it is confirmed that the user is a legitimate user by performing user authentication, the multifunction peripheral 12 of the document is scanned by the scanner 22. Various operations such as a scan operation and a copy operation can be performed.

  Further, the MFP 12 can confirm that the user is a valid user by the authentication device 14 before, and associates the ID information and password information of the user permitted to be registered in the returned identification registration permission information with the HDD 36. I remember it.

  Furthermore, the multifunction machine 12 is configured to accept input of authentication designation information for designating whether or not to allow user authentication based on ID information and password information stored in the HDD 36. The accepted authentication designation information is stored in the HDD 36.

  When using the multifunction machine 12, the user inputs the user ID and password by causing the IC card reader 28 to read a numeric keypad provided on the operation panel 26 or an IC card storing ID information.

  When the multifunction device 12 receives an input of a user ID and password by reading an IC card with a numeric keypad provided on the operation panel 26 or an IC card reader 28, the multifunction device 12 indicates ID information and a password indicating the user ID. The password information is transmitted to the authentication device 14 by the network I / F unit 46 to request user authentication.

  The authentication device 14 authenticates the user by checking whether the ID information and the password information transmitted from the multifunction device 12 are stored in the HDD 86, and the result information indicating the authentication result and the identification registration permission information are displayed. 12 to send.

  When the result information is obtained from the authentication device 14, the multifunction machine 12 authenticates the user according to the result information.

  When the authentication device 14 can confirm that the MFP 12 is a valid user and registration is permitted in the returned identification registration permission information, the MFP 12 associates the ID information and password information of the user with each other. Register in the HDD 36.

  Further, the MFP 12 is not permitted to obtain result information from the authentication device 14 and is permitted to authenticate the user by checking the ID designation information and password information stored in the HDD 36 in the authentication designation information stored in the HDD 36. The user is authenticated by the ID information and password information stored in the HDD 36.

  In addition, the MFP 12 according to the present embodiment stores the monitoring time for determining whether or not communication with the authentication device 14 is impossible in the authentication designation information stored in the HDD 36. The user ID is changed depending on whether or not user authentication based on the ID information and password information is permitted.

  Next, a detailed processing flow of the multifunction machine 12 when performing user authentication will be described.

  FIG. 4 shows a flowchart showing a flow of processing of a user authentication program executed by the CPU 30 when an input of a user ID is accepted by the operation panel 26. The program is stored in advance in a predetermined area of the ROM 32.

  In step 200 in the figure, if the authentication designation information stored in the HDD 36 permits the user authentication based on the ID information and password information stored in the HDD 36, the monitoring time is set to 5 seconds, for example. If the authentication is not permitted, the monitoring time is set to 30 seconds, for example.

  That is, in the multifunction machine 12 according to the present embodiment, the monitoring time is shortened when the authentication of the user by the ID information and password information stored in the HDD 36 is permitted in the authentication designation information, compared with the case where the authentication is not permitted. doing. Thus, when communication failure occurs in the network 16 and communication with the authentication device 14 cannot be performed, the user authentication is quickly switched to the ID information and password information stored in the HDD 36.

  In the next step 202, ID information indicating the user ID accepted by the operation panel 26 and password information indicating the password are transmitted from the network I / F unit 46 to the authentication device 14 via the network 16 to request user authentication. To do.

  In the next step 204, it is determined whether or not the result information and the identification registration permission information are received from the authentication device 14. If the result information and the identification registration permission information are received, the process proceeds to step 208. If the identification registration permission information is not received, the process proceeds to step 206.

  In step 206, it is determined whether or not the monitoring time set in step 200 has elapsed since the transmission of the ID information and password information in step 202. If the determination is affirmative, the process proceeds to step 220. If it is determined, the process proceeds to step 204 to wait for reception of the result information and the identification registration permission information.

  In step 208, it is determined whether or not the user is authorized to use in the received result information. If the determination is affirmative, the process proceeds to step 210, whereas the determination is negative. Proceeds to step 236.

  In step 210, login to the apparatus is permitted, the operation panel 26 is validated, and various operations on the operation panel 26 are accepted.

  In the next step 212, it is determined whether or not registration is permitted in the identification registration permission information returned from the authentication device 14. If the determination is affirmative, the process proceeds to step 216. If the determination is negative, Control goes to step 240.

  In step 216, the ID information and password information of the user who has been authenticated in step 208 are associated with each other and stored in the HDD 36.

  On the other hand, in step 220, it is determined whether or not user authentication is permitted by checking the ID designation information and password information stored in the HDD 36 in the authentication designation information stored in the HDD 36. Shifts to step 228, and if negative determination is made, shifts to step 236.

  In step 228, the user ID information received by the operation panel 26 is stored in the HDD 36, and the password information received by the operation panel 26 matches the password information associated with the user ID information stored in the HDD 36. By verifying whether or not to use, authentication is performed as to whether or not the user is permitted to use.

  In the next step 232, it is determined whether or not the ID information and the password information can be collated. If the collation is successful, the process proceeds to step 234. If the collation cannot be performed, the process proceeds to step 236.

  In step 234, login to the apparatus is permitted, the operation panel 26 is validated, and various operations on the operation panel 26 are accepted.

  On the other hand, in step 236, login to the apparatus is not permitted, the operation panel 26 is invalidated, and various operations on the operation panel 26 are not accepted.

  In step 240, the authentication result is displayed on the display unit provided on the operation panel 26, and the user authentication program is terminated.

  As described above, according to the present embodiment, security is enhanced by performing authentication using a user ID and a password.

  Further, according to the present embodiment, since it is possible to select whether or not to allow user authentication based on the authentication designation information, security is enhanced by making a selection not permitted as necessary.

Further, according to the present embodiment, when authentication of the user is permitted by the ID information and password information stored in the HDD 36 in the authentication designation information, even if a failure occurs in the network 16, the user authentication is promptly performed. Yes.
[Third Embodiment]
Since the configuration of the user authentication system 10 according to the third embodiment and the configuration of the multifunction machine 12 and the authentication device 14 are the same as those of the first embodiment (see FIGS. 1 and 2), here. Description of is omitted.

  Next, user authentication by the user authentication system 10 according to the present embodiment will be briefly described.

  Similar to the second embodiment described above, the authentication device 14 according to the present embodiment stores in the HDD 86 the ID information and password information of a user who is permitted to use each multifunction device 12 registered in advance in association with each other. ing.

  On the other hand, the multifunction machine 12 according to the present embodiment performs user authentication using a user ID and a password, as in the second embodiment described above.

  Further, the multifunction machine 12 accepts input of password registration permission information indicating whether or not to permit registration of password information in the HDD 36 when the result information cannot be obtained from the authentication device 14 from the operation panel 26. ing. The accepted password registration permission information is stored in the HDD 36.

  The MFP 12 according to the present embodiment can confirm that the user is a valid user by performing user authentication, and if the password registration permission information stored in the HDD 36 permits the password registration to the HDD 36, the user If the password registration permission information does not permit registration of the password in the HDD 36, only the ID information of the user is registered. Register in the HDD 36.

  In addition, when the MFP 12 according to the present embodiment becomes unable to communicate with the authentication device 14, the physical layer conversion unit (PHY (Physical Layer) to which the communication cable of the network I / F unit 92 is connected. Device)), for example, it is detected whether or not the communication cable is physically connected by detecting the voltage state of the signal line. If the cause of the disconnection is a disconnection of the communication cable, the ID information Is prohibited based on whether or not is stored in the HDD 36.

  Next, a detailed processing flow of the multifunction machine 12 when performing user authentication will be described.

  FIG. 5 shows a flowchart showing a flow of processing of a user authentication program executed by the CPU 30 when an input of a user ID is accepted by the operation panel 26. In the figure, the same processes as those in FIG. 4 are denoted by the same reference numerals as those in FIG. The program is stored in a predetermined area of the ROM 32 in advance.

  In step 214 in the figure, it is determined whether or not the password registration permission information stored in the HDD 36 is permitted to register the password in the HDD 36. If the determination is affirmative, the process proceeds to step 216, but the determination is negative. If YES, go to step 218.

  In step 218, the ID information of the user who has been authenticated in step 208 is registered and stored in the HDD.

  On the other hand, in step 222, the cause of the disconnection is specified.

  In the next step 224, it is determined whether or not the cause of the disconnection is a disconnection of the communication cable. If the determination is affirmative, the process proceeds to step 236. If the determination is negative, the process proceeds to step 226.

  Thereby, for example, even if the communication cable is removed maliciously in order to authenticate the user with the ID information stored in the HDD 36, the user authentication based on whether or not the ID information is stored in the HDD 36 is prohibited. Is done.

  In step 226, it is determined whether or not the password registration permission information stored in the HDD 36 is permitted to register the password in the HDD 36. If the determination is affirmative, the process proceeds to step 228. If the determination is negative, Control goes to step 230.

  In step 230, it is verified whether or not the user is permitted to use by collating whether or not the user ID information received by the operation panel 26 is stored in the HDD 36.

  As described above, according to the present embodiment, even if the communication cable is intentionally disconnected, a decrease in security is suppressed.

  Further, according to the present embodiment, it is possible to select not to register the password information in the HDD 36 by the password registration permission information, so that a reduction in security is suppressed.

  In each of the above embodiments, the case where password registration permission information is set from the operation panel 26 of the multifunction machine 12 has been described. However, the present invention is not limited to this, and for example, password registration permission information is authenticated. It may be transmitted from the apparatus 14 to the multifunction machine 12.

  Further, although cases have been described with the above embodiments where the multifunction machine 12 is used as the information processing apparatus, the present invention is not limited to this, and communicates with the authentication apparatus 14 via the network 16. Any information processing apparatus that performs user authentication may be used, for example, a personal computer.

  In addition, the configuration (see FIGS. 1 and 2) of the multifunction machine 12 and the authentication device 14 described in the first embodiment is an example, and can be appropriately changed without departing from the gist of the present invention. Needless to say.

  Further, the flow of processing of the user authentication program described in each of the above embodiments (see FIGS. 3 to 5) is also an example, and it goes without saying that it can be appropriately changed without departing from the gist of the present invention. .

DESCRIPTION OF SYMBOLS 10 User authentication system 12 Each multifunction device 14 Authentication apparatus 16 Network 26 Operation panel (reception means)
28 Card reader (reception means)
30 CPU (authentication means, registration means, prohibition means)
36 HDD (storage means)
46 Network I / F section (communication means, identification means)

Claims (10)

A communication means for communicating with an authentication device that performs authentication as to whether or not the user is permitted to use via a connected communication cable;
Accepting means for accepting input of identification information for identifying the user;
When the input of the identification information is received by the reception unit, the identification information is transmitted to the authentication device by the communication unit to request user authentication, and when the authentication device can authenticate, Storage means for storing identification information received by the receiving means as information used when communication with the authentication device is interrupted;
An authentication means for authenticating a user with the identification information stored in the storage means and the identification information received by the receiving means when communication with the authentication device is interrupted ;
Accepting input of authentication designation information for designating whether or not to allow user authentication based on the identification information stored in the storage means;
The authentication means uses the identification information stored in the storage means and the accepting means when user authentication is permitted in the authentication designation information and communication with the authentication device is interrupted. An information processing apparatus that authenticates a user with received identification information . When the input of the identification information is received by the reception unit, the identification information is transmitted to the authentication device by the communication unit to request user authentication. Control means for controlling the identification information received by the receiving means so as not to be stored in the storage means;
  The information processing apparatus according to claim 1, further comprising: A means for identifying the cause of the disconnection when communication with the authentication device is interrupted;
When the cause of the disconnection specified by the specifying means is a disconnection of the communication cable in the communication means, the authentication means prohibits user authentication with the identification information stored in the storage means and specifies Authentication control means for permitting user authentication with the identification information stored in the storage means by the authentication means, when the cause of the disconnection made is not disconnection of the communication cable in the communication means;
Further information processing apparatus according to claim 1 or claim 2, wherein comprising a. The authentication unit, when the user authentication is permitted in the authentication designation information, than if they are not allowed, the authentication device to determine whether the information of the authentication result from the authentication device is obtained The monitoring time for monitoring the communication status with
The information processing apparatus according to any one of claims 1 to 3. In response to the user authentication request from the authentication unit, the authentication device returns identification registration permission information indicating whether or not to permit storage of the user identification information in the storage unit together with information on the authentication result. ,
The storage means stores the identification information in the storage means and stores the identification information in the storage means when storage is permitted by the identification registration permission information when the information indicating that the authentication is successful is received from the authentication device. If the storage is not permitted by the permission information, do not store the identification information in the storage means,
The information processing apparatus according to any one of claims 1 to 4. The accepting means accepts input of password information indicating a password of the user together with identification information for identifying the user,
The storage means stores the identification information and the password information in association with each other when the information indicating that the authentication is successful is received from the authentication device;
The authentication unit authenticates a user using the identification information and password information stored in the storage unit and the identification information and password information received by the receiving unit when communication with the authentication device is interrupted. The information processing apparatus according to any one of claims 1 to 5. The storage means further stores password registration permission information indicating whether or not to permit registration of the password information;
The storage means receives information from the authentication device that the authentication has been successful, and stores the identification information and password information in the storage means when registration is permitted in the password registration permission information. Information is received from the authentication device, and when registration is not permitted in the password registration permission information, only the identification information is stored,
The authentication means uses the identification information stored in the storage means and the receiving means when registration with the password registration permission information is not permitted and communication with the authentication device is interrupted. The information processing apparatus according to claim 6, wherein user authentication is performed with the received identification information. Whether it is a user when the input of the identification information is accepted by the accepting means for accepting an input of identification information for identifying a user, to allow for by Ri uses to communicate means through the connected communication cable A transmission step for transmitting to an authentication device for performing authentication,
A storage step of storing in the storage means the identification information received by the receiving means as information to be used when communication with the authentication apparatus is interrupted when the authentication apparatus can authenticate;
Based on the identification information stored in the storage means, an input of authentication designation information for designating whether or not to permit user authentication is accepted, the user authentication is permitted in the authentication designation information, and the authentication An authentication step of authenticating a user with the identification information stored in the storage means and the identification information received by the receiving means when communication with the device is interrupted;
Authentication program that causes a computer to execute. A control step for controlling the storage unit not to store the identification information received by the receiving unit when the authentication device cannot authenticate;
  The user authentication program according to claim 8, further comprising: A specific step of identifying the cause of the disconnection when communication with the authentication device is interrupted;
When the cause of the disconnection specified in the specifying step is a disconnection of the communication cable in the communication means, the authentication of the user with the identification information stored in the storage means in the authentication step is prohibited and specified. An authentication control step for permitting user authentication with the identification information stored in the storage means by the authentication step when the cause of the disconnection is not a disconnection of the communication cable in the communication means;
The user authentication program according to claim 8 or 9, further comprising:

Images